Skip to main content

IClickFix

Malware Family

9 521 indicators of compromise attributed to IClickFix across abuse.ch threat intelligence feeds.

Domains

9 294

IPs

36

URLs

186

Hashes

5

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (9 294)IPs (36)URLs (186)Hashes (5)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
repviajes.comdomain
gold.albaikmenuonline.comdomain
wildwoodwoolery.comdomain
louadby.comdomain
haytekkimya.com.trdomain
eaglepointtravel.comdomain
estrella.fincavrij.nldomain
mpmgalvez.comdomain
h2onero.comdomain
superbbicycle.comdomain
88dewahoki.shopdomain
fktlomas.comdomain
alqernas.comdomain
idosotthon-gyula.hudomain
lalupa.codomain
activeenvironments.netdomain
kaynakegitimi.comdomain
chantalcollincoaching.comdomain
sportsdisport.comdomain
dobrykelner.pldomain
94.26.90.126ip
165.227.123.79ip
91.92.34.76ip
91.92.241.182ip
91.92.240.121ip
91.92.240.117ip
91.92.33.149ip
176.65.144.108ip
167.148.195.30ip
85.239.144.81ip
94.26.90.23ip
158.94.208.87ip
91.236.230.121ip
85.239.147.30ip
95.129.234.18ip
31.57.108.64ip
138.124.60.214ip
193.233.201.114ip
194.26.192.83ip
185.196.8.142ip
https://biaolfkfkakajsfj.com/asdggg.jsurl
http://103.150.186.125/1url
https://rehearsal-b.com/4qX0LB/tm/ysm6url
https://mesa-braior-k3w3b.life/t.jsurl
https://djasdajnsdnjgjg.com/sdfggg.jsurl
http://cloflart.com/cf.phpurl
http://157.245.34.109:8080/update.cmdurl
http://93.113.25.102/msi/e69378480adab23durl
http://151.240.151.158/tta.txturl
http://antongandon.club/url
https://fotolateras.comurl
http://95.164.53.115:5506/do.vbsurl
https://mvjfkakfkfkaiai.com/dasgggg.jsurl
http://185.163.204.237/2eue.jsonurl
https://ashen-trace-zephyr-draeix.life/t.4b1009ff6c3f.jsurl
http://155.193.53.83:17589/booturl
https://primetimehost.me/ama.php?page=url
http://197.214.149.148:80/booturl
http://pub-18653d64d62d4ec886510b90fdfce453.r2.dev/GCt12d.zipurl
http://80.253.249.186:5504/vm.baturl

Another file to check? Run a file hash reputation check.